The DeadLock ransomware operation has adopted a decentralized infrastructure leveraging blockchain technology to enhance the resilience of its communication channels with victims and its data leak activities. The group, which emerged in mid-2025, employs a double-extortion model, stealing data before encrypting files to pressure victims into paying ransoms. By July of the current year, DeadLock's data leak site reportedly listed 80 organizations, predominantly in Europe, spanning sectors such as IT, mining, transportation, manufacturing, hospitality, and consumer goods.
Microsoft researchers have observed DeadLock malware being deployed by multiple groups, including an affiliate previously associated with the Lynx and INC ransomware ecosystems. The operators have integrated the Polygon blockchain to store configuration data and posts for their leak site. Instead of relying on a traditional Tor URL, the HTML page for victim communication retrieves the current chat-proxy address by querying a smart contract on the Polygon blockchain via a read-only `eth_call`.
While retrieving command-and-control (C2) addresses from the blockchain is a growing tactic among cybercriminals, its use in the ransomware space remains uncommon. Furthermore, DeadLock utilizes the decentralized Session network for encrypted victim communications and provides access to stolen files hosted on the Wasabi cloud service. This setup allows operators to replace chat proxies without altering the victim-facing application, thereby reducing their dependence on conventional domains and web servers that are susceptible to law enforcement takedowns.
However, Microsoft noted that this resilience is not absolute. Communications still depend on a custom proxy, public Polygon RPC endpoints must remain accessible, and files hosted on Wasabi could potentially be removed.
Regarding its encryption scheme, DeadLock is configured to avoid systems in countries of the former Soviet Union and the Commonwealth of Independent States (CIS) region, as well as Iran, Syria, Oman, and Yemen. The ransomware prepares the Windows host by deleting backups, stopping virtualization services, and emptying the Recycle Bin. It then encrypts selected non-system directories using unique per-file XChaCha20 keys, protected with the Curve25519 elliptic curve.
The ransomware is designed to utilize up to 29% of available system memory and 70% of CPU resources, aiming to allow victims to continue using their machines during encryption without significant performance degradation. Larger files are intermittently encrypted using 512-byte blocks to accelerate the process while still rendering them largely irrecoverable. Encrypted data is renamed with a victim-specific identifier and the `.dlock` extension, file icons are changed, TXT ransom notes are dropped, and the desktop wallpaper is altered to indicate system compromise.
Attackers demand ransom payments in Bitcoin or Monero. In exchange, they promise a decryptor, deletion of stolen data, details about the initial access vector, and a set of security recommendations.
To defend against DeadLock ransomware attacks, Microsoft advises strengthening endpoint defenses with cloud-delivered antivirus protection, EDR in block mode, tamper protection, automated investigation and remediation, and automatic attack disruption. Organizations should also restrict unauthorized file changes using Controlled Folder Access and enable attack-surface reduction rules to block untrusted executables and lateral movement via tools like PsExec and WMI.
